Get data from FIFO queues

This topic describes how to configure a FIFO input using inputs.conf. Defining FIFO inputs is not currently supported in Splunk Web/Manager.

Caution: Data sent via FIFO is not persisted in memory and can be an unreliable method for data sources. To ensure your data is not lost, use monitor instead.

Add a FIFO input to inputs.conf

To add a FIFO input, add a stanza for it to inputs.conf in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. If you have not worked with Splunk's configuration files before, read about configuration files before you begin.

Here's the basic syntax for adding a FIFO stanza:

[fifo://<path>]
<attrbute1> = <val1>
<attrbute2> = <val2>
...

This input stanza directs Splunk to read from a FIFO at the specified path.

You can use the following attributes with FIFO stanzas:

host = <string>

Sets the host key/field to a static value for this stanza.

Sets the host key's initial value. The key is used during parsing/indexing, in particular to set the host field. It is also the host field used at search time.

The <string> is prepended with 'host::'.

If not set explicitly, this defaults to the IP address or fully qualified domain name of the host where the data originated.

Explicitly declares the source type for this data, as opposed to allowing it to be determined automatically. This is important both for searchability and for applying the relevant formatting for this type of data during parsing and indexing.

Sets the sourcetype key's initial value. The key is used during parsing/indexing, in particular to set the source type field during indexing. It is also the source type field used at search time.

The <string> is prepended with 'sourcetype::'.

If not set explicitly, Splunk picks a source type based on various aspects of the data. There is no hard-coded default.

Note: Overriding the source key is generally not recommended. Typically, the input layer will provide a more accurate string to aid in problem analysis and investigation, accurately recording the file from which the data was retreived. Please consider use of source types, tagging, and search wildcards before overriding this value.

The <string> is prepended with 'source::'.

Defaults to the input file path.

queue = [parsingQueue|indexQueue]

Specifies where the input processor should deposit the events that it reads.

Set to "parsingQueue" to apply props.conf and other parsing rules to your data.

Comments

Get data from FIFO queues

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »